Auth bypass in Vercel @Ai-sdk/harness-opencode
CVE-2026-64651
The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (`host…
Vulnerability class: Broken Access Control
Affected products
- Vercel @Ai-sdk/harness-opencode — versions < 1.0.29
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)